diff options
| author | Zijun Hu <zijun.hu@oss.qualcomm.com> | 2026-08-01 23:31:42 -0700 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-08-07 15:40:27 -0400 |
| commit | 9a4fa3cddc692efb47515c45fe05217369448bde (patch) | |
| tree | 20e0b5d9cbac313948978562e0e814bf28374634 /include | |
| parent | 0bd606b31d40dceb718bf22e3ce7b4cff7e34bf6 (diff) | |
| download | linux-9a4fa3cddc692efb47515c45fe05217369448bde.tar.gz linux-9a4fa3cddc692efb47515c45fe05217369448bde.zip | |
Bluetooth: hci_event: Use 255 as max event payload length in hci_ev_table[]
hci_event_func() validates skb->len against ev->max_len from the
entry in hci_ev_table[]. By then, the header has already been
stripped by skb_pull(). So the max event payload is 255, but
hci_ev_table[] still uses HCI_MAX_EVENT_SIZE (260) for it, which is
imprecise.
Fix by introducing HCI_MAX_EVENT_PLEN (255) and using it instead.
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/bluetooth/hci.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index cd3520a29131..1641d879dbda 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -3382,6 +3382,7 @@ struct hci_ev_si_security { /* ---- HCI Packet structures ---- */ #define HCI_COMMAND_HDR_SIZE 3 #define HCI_EVENT_HDR_SIZE 2 +#define HCI_MAX_EVENT_PLEN 255 #define HCI_ACL_HDR_SIZE 4 #define HCI_SCO_HDR_SIZE 3 #define HCI_ISO_HDR_SIZE 4 |